hxxps://breathtaker[.]com[.]au/

Analysis

max time kernel
89s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://breathtaker.com.au/
Sample260418-mpvwraev6s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4928_2050413760\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4928_1207340790\_locales\sw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3760	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209834021034458"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{09D9624C-1232-4511-BDA0-AFF46BBD6D51}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4832	4928	msedge.exe	85
PID 4928 wrote to memory of 4988	4928	msedge.exe	86
PID 4928 wrote to memory of 3760	4928	msedge.exe	87
PID 4928 wrote to memory of 4988	4928	msedge.exe	86
PID 4928 wrote to memory of 4988	4928	msedge.exe	86
PID 4928 wrote to memory of 4088	4928	msedge.exe	89
PID 4928 wrote to memory of 4088	4928	msedge.exe	89
PID 4928 wrote to memory of 3856	4928	msedge.exe	90
PID 4928 wrote to memory of 3856	4928	msedge.exe	90
PID 4928 wrote to memory of 3856	4928	msedge.exe	90
PID 4928 wrote to memory of 4220	4928	msedge.exe	91
PID 4928 wrote to memory of 4220	4928	msedge.exe	91
PID 4928 wrote to memory of 4220	4928	msedge.exe	91
PID 4928 wrote to memory of 1604	4928	msedge.exe	97
PID 4928 wrote to memory of 1604	4928	msedge.exe	97
PID 4928 wrote to memory of 1604	4928	msedge.exe	97
PID 4928 wrote to memory of 4644	4928	msedge.exe	101
PID 4928 wrote to memory of 4248	4928	msedge.exe	102
PID 4928 wrote to memory of 4644	4928	msedge.exe	101
PID 4928 wrote to memory of 4248	4928	msedge.exe	102
PID 4928 wrote to memory of 4172	4928	msedge.exe	104
PID 4928 wrote to memory of 5328	4928	msedge.exe	108
PID 4928 wrote to memory of 3060	4928	msedge.exe	109
PID 4928 wrote to memory of 2508	4928	msedge.exe	110
PID 4928 wrote to memory of 1568	4928	msedge.exe	111
PID 4928 wrote to memory of 1568	4928	msedge.exe	111
PID 4928 wrote to memory of 740	4928	msedge.exe	112
PID 4928 wrote to memory of 740	4928	msedge.exe	112
PID 4928 wrote to memory of 2624	4928	msedge.exe	113
PID 4928 wrote to memory of 2624	4928	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://breathtaker.com.au/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff83f0cc188,0x7ff83f0cc194,0x7ff83f0cc1a0
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,12168348079547522468,16727995975338134924,262144 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16084162268199938911,12305739882707843140,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5370868291954966798,2750606228382245758,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1202363153067948719,11382803887492981002,2097152 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8035430107711612347,12529786286885541582,2097152 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5104,i,3426169592848369084,14890533766333227081,2097152 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,379628883684572122,5000178012424377651,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8658688848136235892,14633124560218656054,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,640017591137296515,1587804380302830427,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,640017591137296515,1587804380302830427,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,4830154481661797180,10344707513358578745,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,16213854190917113931,14999553886592367701,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,7547385588152753536,7143683784665572119,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,549376242026932422,12869985395605146880,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,14200390382970653191,2469375165539956219,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11850886027701074388,11870494339130996344,524288 --field-trial-handle=2288,i,16605673779091185928,12296317677341133237,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 57fab2e2decba4e4322803a8cfdd92d8da3e275bae86133af661b20c94e82407
MD5 173e0fea2f78f1d23ed688ba5c44e3a0
SHA1 fc2c4f80904356cfdeabcc57064a18b04ccb5f31
SHA512 53d64171a65c0055d1ec72b8967bd8ad6be0bcd7186ec7c63d724f363a5fcaca5408c660a55f94f921844423d7a6c12c6cd572225321a8397ab2ecc9e569bb27
TLSH
T100E02BAED8219D7B04F9072920964746EB51135B1B50984F3B3DA1088FB06371655C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb101da34f5de3720964f1dd5ca02c2bf3a0bfcd0330882f23682f29980c37d2
MD5 71c270f7d797ffa14b7011bd2dc8ae5e
SHA1 28f891493686b9ee92176e4fe7428a47395d20a6
SHA512 fe23f85bcefb4bb756df425af8633f005c8d986cf93723845f1248f8766a64ed605e7946dafee707c961dfef9c7df14f42b795af978ef28c59cc9bae7d110f13
TLSH
T19C717FB587E1D075EBE4477609AA8C677A318164C8228F9341C3D4FC1F0AEC300B6B6B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58990f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58990f.TMP
Size 2KB
SHA256 573804478370544190991668a54e6ca37672dc02d949a73ea02aae37fbcad0cd
MD5 21a4836eb5a6df6312c8249458a5c594
SHA1 e2661116eefe2bdcc90fb342821529166586b640
SHA512 fff60111fe583ee6493c123a873429f2945aa21503cd595616e80e056c02c87b7f52419942506953a17178d3e707ba5def8d7703ecba07c586be68420522901e
TLSH
T11251F79893F58039FBE447701DE21A5A3B7198284837DEA288C3D4BC2F65F530037B6A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d17b8e8c25ce524a8e4934ec85bbaf1332f210b46aacac62100b4a67b2c763a1
MD5 ef98f43c3a17c08277babefcb6ed85b8
SHA1 009809edb2836cdef167ea409ca333b6b7b460c0
SHA512 f438896e1d6ac42c5389e7f6ed256e48ccf566ad171e97f989a6eda6dfbaadb39e31130c82419fc48ddfd59f18f29651950e5d1d8c636b16bf456ee9aa979064
SSDEEP 192:DObibFbJb0bwbMbxaSJbjbmbWb1bbb5bBbnb9b2bKbELsakj6h:DOeplAkAdaSJvKihHF1TxyeoLsakGh
TLSH
T121C19CF7D2F4822D891556F1A6296E2BCE190528D36C3C8ACAD4DF4FA7F2530D14096E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 185227edc7ad92b2984f11d6d6fab584f7dd05a05e679b0be7d8cb28502a500e
MD5 7aacfb96d2d90982c525a89b3ea1e305
SHA1 66186353aa5426c2eec769fc08bcbb7212d3789e
SHA512 6985cdd1b8538566b52520beb5110cb1089a660f3591b715a6c1a85d63da3bdae8e3ad48fae8260e64db9d20822893fe07dfbe69a426ffbd8949ad18f09f5812
SSDEEP 192:sxZ6RByMqZ/K1Ml8Mk4/fys+9pZZELgvRzodpb8HW6+WNx3s/DPdkLKm7NivIgj6:sxZ6KM4/fys+z3hvaAHbW/qNqj6
TLSH
T1E972F8566A38997BCCD6D21AF945BF53D6F50523D2944E44AAFCCA0C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1aec73184d78281ec07fd7f653b862cf03699ab7db20ce63429bcaeadad0d399
MD5 3375464e16a98de2ac4b3376b678b148
SHA1 07ccad77f314ccb5833b9fed125b54cbc188e525
SHA512 34409940ac1d3e657b07aecfa64d712458d52d86af947778e614909ff02b722b9e9216ee8b153627013879290aa353a7dbdfd67d8f6c3b1e7c07c80f405012ac
SSDEEP 192:sxZiRByMqZ/K1Ml8Mk4/fysUqZZELgvRzodpb8HW6+WNx3s/DPdkLKG7FNiFIg52:sxZiiM4/fysUq3hvaAHbW/6NqNa
TLSH
T1707209166638997B8CD7D21AF685BF53D6F5052392944E44AAFCDE0C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 b772ea2ca93d0b67b781e6bd4981720ec8265c2f051c3eb88bd72bd61e8fce7d
MD5 86a6dc79577766d5d15e7b9c8a3e62a7
SHA1 dc95505c5d936466205fa5e3714031ca326b83a7
SHA512 3905717a510c536f857ae2905e18eee4a746d7edb3e92c1824caa50b11a04a8b52df57addd566b523d53c56a2a398dc3bd425a8dd84029156d2434a743be91b8
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzEx4Llhf51YroO:A9sqZl+E/BlWvBDeTu1jamEx4LXB1jyx
TLSH
T1EBF2F93B2C0CCB7E4F804E9CEC2A7E9A6EE8018B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a8b60c708365d8dae47dd74f5d08a9e9a020068d95dccd0e8db162caf9e4f897
MD5 2240b25c72ea643d71a6e363d322f065
SHA1 12f61cc4d842b14cd91eb924e3050711a778b27c
SHA512 b6cbbe370534ef04fcac33864b3a53b4b33a2da06d7fbebd0917017677160ad990968b38525973a66a63cf3af66f68efbc3dfb3fae4418ff1313f6c776c3a599
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qne:+BOVglYXrbtZqRvJJ7w
TLSH
T192B23C11753A03803A7E254E9194B56F62C270A37098B82B3BB944B64F6BF20DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d30629a65e04c3464012d471b975264d93e8e99a36752c9815dffd86a3952bb1
MD5 bbc1861434eef3ab842b47117d78555d
SHA1 e76e0787fa1eee2e038bd5b9353d9d5e47b63519
SHA512 ac2c6d16b64e71c63dc9a4821695fdaf1b0fd0b38f0376c773017eb31a38c6e7ee16e0a6dcd162aac2684c9c023beb63020fa8e0e172e5b956ffbf6bc45d4584
SSDEEP 384:nuGiFavqMg3sNK8TUNTUlIm2RihYjgrmvffYiQ8aMQpgQnS7o1dKuiNTWrN1k+rp:utFayv3hwgTi5KY6ab7nmo1ti567
TLSH
T1B8C23B35EC98C9BBECE64F9AEB497A07DEE001A7C58C4AD8D5E85D0D10D359D230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e7ed3918a3f23b0ebf92ccf15c9e6b5adc09f3661343e7898870892cae54d55
MD5 9e39c53c106e95faa6f3e8f7bb75ea4e
SHA1 fb67a04bab3f4c567f8d6cce559a0e2dcff7ed26
SHA512 9a191770e4649bda4e8595ec5edc3a08ff5832c1a28e73cbffa96ba957928a5c91c49a15d1bca3d771f08db27e774efe8d3a581583715b738ffe617aa6f3b69c
SSDEEP 384:nZiFavqM+sNp8TUNTUlI4TRihVKk+mvffYiQ8aMQpiEnn1YhrN1k+rvI+A:wFayTewggijxY6abv1Wq
TLSH
T1FFC23A75E8A4C9A7EDE78F9AB74A7A07DEE0016385CC4ED8EAD85D0D00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a70cca2df45acd4d62ae358dce0a2934a9bf11af1d7d991b17f8f9c8aeb903f
MD5 e955ff3bc26a7af40f64749676e72ac9
SHA1 9046dcc975144c90bce9725987c4c0a8245f5e2e
SHA512 9af3e9230ceb885ddd8b2d7460314e256e388b05b3a0c9e4b3653d9cdbd1253ec3cd724b9c9361978ebbd04a017a240ae3a2770ba197de40eda844c41482d75e
SSDEEP 384:nCiFJjccCs+Bt0S3isNp8TUNTUlI4TRihUKk+mvffYiQ8aMQpiEfn1SBFoYrN1kH:JFJccQCewggigxY6abX1SgM9e
TLSH
T1FDC24A32E8A4CDBBEDE78F9AA34A76479EF00163868C5ED4D9D85E0D00C719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 33ed51a627eeeb09cb7243a47e09d51e66b3e51547c4e83417d1f7ec3cbc1417
MD5 15975efee163fc15fd2657287146c8a0
SHA1 0a0985f771896caa679d673e8e456fa3d38b0422
SHA512 38e8094fb6a4e00f9a268250a0234c158e7d8f598b07e04ba5766287e8c68c75399b5312222a80589152c14115e353aedf72fda3a6d5666c6ba126887bdcf826
SSDEEP 384:n+iFavqMg3sNN8TUNTUlIm2RihgJRPmvffYiQ8aMQpiEUn1S7o1dKuiNTWrN1k+t:VFayv3uwgTiAOY6abW1mo1ti567
TLSH
T111C24B31E898C9BBEDE74F9AAB4A7A07DEE001A7C58C4AD4D9E45D0D10D359D230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b454e35c05326d59dc81dba261a70350659b007567e7638a8c773dbb72d2a77d
MD5 2c280730e45a377bbfe7d01ff75f8b24
SHA1 b87834976ed07f7964ef602a6e2e2352f517318b
SHA512 713e6786c213e06cb72cb7f34e4a349475fa382779a3e82e40ee1d3efbb7e29805d49f7982534fa7a61d09fae9b0a5cc14df083fe4b17abd7dfcd9bf91ae57c7
SSDEEP 384:niiFJjccCs+Bt0S3G2sNp8TUNTUlI4TRihUKk+mvffYiQ8aMQpiEWr1SBFoYrN18:pFJccQXewggigxY6ab01SgM9e
TLSH
T1C2C24A32E8A4C9BBEDE78F9AA3497A079EF01163868C5ED4D9D85E1D00C719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 baa118cb4dcb290f4154d5ff0f39e52de126cadfc32fe4dfea54a0f5c3a30e67
MD5 75b3b0c838bac7da9aafd6046e966235
SHA1 2ffd550542d72c6c065ffb603fec169a0ffee0b5
SHA512 96b17be7ab16a7a711e56d44620549c392db31885ddf645ee6b3337b3f4cef03a4138b13fa06595e04e4e1683669ee0393f731d97d780274537c33e5faa1f97f
SSDEEP 384:nZiFavqMMsNp8TUNTUlI4rRihVKk+mvffYiQ8aMQpiEnn1YhrN1k+rvI+A:wFayxewgSijxY6abv1Wq
TLSH
T17FB24A75E8A4C9A7ECE78F9AE74A7A07DEE01163C58C4ED8EAD81D0D00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c57a1585f0cc7107dea7a869bb96d8db5ad45f3d6bebf7f6dcf11c7dceb40cbb
MD5 7327b715345a6f5e7c7613187a42fce5
SHA1 977d4a4a9fae3298fd34402110462141bbe323f9
SHA512 fe977de4187a5b47aa977a9d09e316a8c3ffd77e761ab54f58f0ebff8f6547bf6b47bdd8cbb5df2d7969bffb8c788bcc84515727477ebfec4a95fe5529b6adf2
TLSH
T1CC41075CABF91108B3B76E5A9BF6A86D847FB9772E0AD05D00110D8F0A32B44D871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4172-601-0x000002032DAB0000-0x000002032DB1B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads